3

I’d like to differentiate machines (or, possibly, users) on my small business network so that only some of them have access to the internet. The solution I’ve been using to this day is quite terrible: clients which should have access to the internet are given a specific IP address based on their MAC address or identifier.

In turn, the firewall has different setting for those predefined IP addresses.

This is poor both in matters of security and usability: changing the IP of a client is even easier than spoofing a MAC address. Moreover, adding a new machine is added to the network implies adding an entry on the DNS server and modifying the firewall settings.

What would be the proper way to restrict access to the internet by clients (or, possibly, users)?

Some details about the environment:

  • it’s for a small business network which doubles as a home network;
  • there are about 15 users + guests;
  • there are about 23 clients on the network + 10 mobile clients;
  • some clients need access to the LAN only, some others (mostly phones) need access to the WAN only, other (access points) to both;
  • 2 main NASes, 1 backup NAS and a few home NAS for clients backup;
  • a Cisco 1921 router with an outdated, no IPsec IOS;
  • a Netgear FS 526T switch;
  • 2 Wireless Access Points, of which the model escape me right now; I believe they’re part Cisco Small Business range;
  • the utter lack of business lately means that investments above a few hundreds euros are probably unreasonable.
Improve this question
5
  • In case this wasn’t obvious from the question, I’m a network administration newbie.
    – Édouard
    Nov 5, 2015 at 1:06
  • More information about your environment would be helpful. Is this an institutional environment? A small business? A home network? What kind of equipment are you using or willing to consider? How many users, roughly?
    – Xander
    Nov 5, 2015 at 1:34
  • Can you fix network connections to the hardware and then manage everything via physical network?
    – Neil Smithline
    Nov 5, 2015 at 4:47
  • What's your budget for solving this problem?
    – k1DBLITZ
    Nov 6, 2015 at 18:40
  • @k1DBLITZ Right up there, on the last line ;-)
    – Édouard
    Nov 7, 2015 at 2:11

2 Answers 2

Reset to default
1

you need to start using VLANs and turn off inter vlan routing.

using VLANs you will be able to create multiple LANs within a single network but all of them be independant, all traffic from your router at the moment is most likely tagged as VLAN 1 (even though you do not know it).

you can also use VPN traffic, create VPN access on the network and anyone with the VPN credentials can get through the firewall.

Anything using MacAddress or IP address is pointless, you might as well do nothing.

I would need more details but you can have to WIFI access points in your office, one on a vlan 20 for example... all vlan 20 traffic will be locked down by the fire wall.

There are so many possibilities but VLANs AND/OR VPNs are your best bet.

Trust me I am a network engineer! (so much information I struggle to type ask me more specific questions for more specific answers)

Improve this answer
0

You could use a NAC (network access control) like PacketFence. This still can succumb to MAC spoofing, but it gets way more powerful if you use it with smart switches and access points, perhaps in tandem with 802.1X.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .